CVE-2025-66376: Russian APT Exploits Zimbra Zero-Day

CVE-2025-66376 is a stored cross-site scripting vulnerability in the Classic UI of Zimbra Collaboration Suite, creating a path to mailbox theft and abuse of the user’s authenticated webmail session.

The flaw was exploited as a zero-day before Zimbra released fixes in November 2025. A joint government advisory associates the activity primarily with the Russian state-supported actor LAUNDRY BEAR, while other researchers use names including Void Blizzard, CL-STA-1114, and TA488 for related activity.

This article explains the vulnerability, affected versions, exploitation evidence, technical root cause, potential impact, public proof-of-concept status, and the actions defenders should take to reduce exposure and investigate possible compromise.

What Is CVE-2025-66376?

CVE-2025-66376 (CVSS 6.1) is a stored cross-site scripting, or XSS, vulnerability in Zimbra Collaboration Suite’s Classic UI email-rendering functionality. The vulnerability is classified as CWE-79, which covers improper neutralization of input during web-page generation.

Government agencies and security researchers characterize the exploit as a “view-based,” nearly zero-click threat – the target simply needs to display the email, with no link clicks or attachment openings necessary.

The root cause is inadequate sanitization of specially crafted HTML and CSS content. Zimbra’s sanitizer did not fully neutralize a combination of CSS @import handling and HTML elements. Malicious content could therefore survive filtering and execute JavaScript inside an authenticated Zimbra webmail session when the message was displayed.

CVE-2025-66376 is not described as server-side Remote Code Execution or a direct operating-system compromise. Its security impact comes from allowing attacker-controlled script to operate within the privileges and session context of a targeted Zimbra user.

Which Zimbra Versions Are Affected?

The available vulnerability records identify these affected release lines:

• Zimbra Collaboration 10.0 versions before 10.0.18
• Zimbra Collaboration 10.1 versions before 10.1.13

Zimbra lists the fixes in versions 10.0.18 and 10.1.13. Organizations should upgrade to at least the applicable fixed version and, where possible, move to a currently supported release.

It is also important to mention that the 10.0 branch reached end of life on December 31, 2025. The patched 10.0 branch should therefore not be treated as a long-term lifecycle solution.

The available records specifically identify the Classic UI and HTML email-rendering path. They do not establish that every Zimbra interface, mobile client, or non-Classic UI is affected. Administrators should confirm interface usage and patch status rather than assuming that a different client eliminates all exposure.

When Are You Most Exposed?

Organizations face the greatest risk when they operate an affected Zimbra version with a reachable mail service and users access mail through the vulnerable Classic UI. Exploitation also depends on delivery of a malicious message and its rendering in a vulnerable session.

A server does not need to be compromised before the message arrives. Internet-facing Zimbra systems and accounts with access to sensitive correspondence should receive priority for remediation.

What Component Is Vulnerable, and Why Does It Matter?

The vulnerable component is the Classic UI’s webmail email-rendering functionality, including its processing of HTML and CSS embedded in messages. The relevant security primitive is stored cross-site scripting: attacker-controlled content is stored in an email and later interpreted by the web interface as part of the page shown to a recipient.

Security documentation describes obfuscated HTML that used CSS @import directives and a hidden SVG-based event handler. Researchers also refer to fragmented or “tag-split” markup intended to evade the Zimbra sanitizer. These details help defenders understand the content to investigate, but the basic root cause is that dangerous content reached a browser context where it could execute within an authenticated Zimbra session.

The impact depends on the victim’s account permissions and the data available through that session. A standard mailbox may contain months of sensitive correspondence, contact data, attachments, account metadata, and information useful for further social engineering. Accounts with broader organizational access may present a more valuable target.

How Could CVE-2025-66376 Be Exploited?

At a high level, the attack workflow consists of four stages:

• The attacker identifies a reachable Zimbra deployment running an affected version.
• The attacker delivers an email containing specially crafted HTML content to a target mailbox.
• The recipient views the message through the vulnerable Classic UI.
• The content executes JavaScript in the context of the authenticated webmail session.

According to campaign analysis, the attacker does not need the victim’s password before delivery. The attack also does not require a link click or attachment execution after the message is rendered. Viewing the message remains a practical condition for exploitation, which explains the difference between “zero-click” shorthand and the more precise view-based description.

Technical analysis indicates that the script could access information available through the user’s session and initiate actions through Zimbra functionality. The observed campaign reportedly targeted recent email, address-book information, account and mailbox metadata, 2FA recovery material, and application passcode functions.

Is CVE-2025-66376 Being Actively Exploited?

Yes. The vulnerability was exploited as a zero-day before Zimbra fixed it. A joint advisory published by U.S., Dutch, and other partner agencies states that Russian state-supported actors targeted Western government and commercial organizations beginning at least in July 2025. It also says the exploit continued to be used successfully against vulnerable systems.

The key timeline is:

• At least July 2025: Reported targeting of Zimbra users began.
• November 6, 2025: Zimbra fixed the issue in 10.0.18 and 10.1.13, according to the vendor context summarized in the vulnerability records.
• January 5, 2026: The CVE was published in the NVD and MITRE records.
• March 18, 2026: CISA added CVE-2025-66376 to the Known Exploited Vulnerabilities catalog, with an April 1, 2026 remediation deadline for applicable organizations.
• July 22 and 23, 2026: Government advisory material and related reporting publicly described the campaign and its technical behavior.

The advisory associates the activity primarily with LAUNDRY BEAR. It also lists Void Blizzard, CL-STA-1114, and TA488 as community tracking names, while cautioning that those labels may not map one-to-one.

Unpatched Zimbra systems that receive email should be treated as exposed to a demonstrated attack path. Campaign-wide victim counts and the precise relationship among the named actor clusters remain unconfirmed.

What Impact Can CVE-2025-66376 Have?

The reported campaign focused on espionage-oriented collection rather than ransomware or destructive activity. According to the joint advisory, observed or attempted collection included:

• Recent email, including approximately 90 days of messages
• The organization’s Global Address List
• Account and mailbox metadata
• 2FA recovery or scratch codes
• Browser-saved or autofilled credentials, according to vendor findings
• Newly created Zimbra application passcodes

The advisory reports that collected data was sent to actor-controlled infrastructure, including systems associated with the actors’ Flowerbed collection framework. The precise number of affected organizations and accounts has not been publicly established.

The vulnerability also creates a persistence concern. Evidence details the creation of application passcodes, including passcodes named ZimbraWeb. If an attacker obtains credentials, active session material, application passcodes, or 2FA recovery codes, applying the software patch alone may not remove access that was already established or reverse data that was already collected.

The risk extends beyond email confidentiality. Stolen correspondence can expose business plans, internal contacts, authentication details, and information useful for follow-on phishing. A compromised mailbox can also be used to impersonate a trusted user, although the reviewed sources do not establish the scale of that activity.

CVE-2025-66376 does not provide direct server compromise – its impact is authenticated-session abuse leading to mailbox theft, credential exposure, and account persistence, leading to intrusion activity. That impact can be substantial for government, defense, financial, and other organizations whose email systems contain sensitive information.

How Can SOCRadar Help?

Defend your organization proactively with SOCRadar’s Cyber Threat Intelligence module. Our platform unifies external risk data, helping you transition from reactive alerting to proactive defense. Our specialized intelligence capabilities include:

• Vulnerability Intelligence: Track CVEs in real-time and prioritize remediation based on actual exploitation context – crucial for mitigating risks like CVE-2025-66376.
• Threat Actor Intelligence: Monitor adversary campaigns, map tactics, techniques, and procedures (TTPs), and correlate malicious activity to known threat groups like those involved in this campaign.

SOCRadar’s Vulnerability Intelligence

Other key platform capabilities include:

• Real-Time Threat Hunting: Identify Indicators of Compromise (IoCs) and track threat actor movements across your digital footprint.
• Automated Risk Prioritization: Focus security efforts on the vulnerabilities and threats that pose the greatest risk to your specific technology stack.
• Unified Intelligence Ecosystem: Connect external risk signals with internal context for faster, data-driven security decisions and reduced operational friction.

What Should Defenders Do Right Now?

Patch Zimbra Immediately

Upgrade affected systems to at least 10.0.18 or 10.1.13, depending on the release line in use. Organizations operating the 10.0 branch should plan migration to a supported Zimbra release rather than relying on the legacy branch indefinitely.

Because CVE-2025-66376 is listed in CISA KEV and has confirmed exploitation, remediation should be treated as an active security response rather than deferred to a routine maintenance cycle.

Reduce Exposure If Patching Is Delayed

If immediate patching is not possible, follow the joint advisory’s recommendation to limit or suspend use of the Classic UI. Organizations can direct users to an alternative mail client temporarily, provided that doing so does not introduce a different unassessed risk.

This is a temporary exposure-reduction measure, not a replacement for upgrading. Administrators should also confirm which users still depend on the vulnerable interface and reduce unnecessary public exposure where operationally feasible.

Treat Potentially Targeted Accounts as Compromised

Identify users who accessed suspicious messages through an affected Classic UI deployment. For potentially exposed accounts:

• Reset passwords.
• Invalidate active sessions.
• Revoke Zimbra application passcodes.
• Regenerate 2FA scratch codes.
• Review whether browser-saved or autofilled credentials may have been exposed.

Patching prevents further exploitation of the vulnerable rendering path, but it does not reverse data access that may already have occurred. Credential and session remediation should accompany the software update.

Search for Related Messages

Search mailboxes for suspicious HTML messages that share unusual body structures, sender patterns, subjects, or other characteristics with known malicious samples. Quarantine related copies where appropriate, while preserving evidence needed for investigation.

Because the attack can execute when a message is rendered, avoid opening suspicious messages in a vulnerable Classic UI environment during analysis.

How Can Teams Detect and Hunt for CVE-2025-66376 Activity?

Detection should combine Zimbra application logs, mailbox review, browser telemetry, and network monitoring. No single indicator proves exploitation, and the absence of one artifact does not rule it out.

Review Zimbra Logs

The joint advisory recommends reviewing /opt/zimbra/log/mailbox.log for unusual SOAP activity. Prioritize events that occur shortly after a user received or viewed a suspicious message.

Look for:

• Bursts of SearchGalRequest activity from a single user
• Unexpected CreateAppSpecificPasswordRequest events
• Application passcodes named ZimbraWeb
• Unexpected GetScratchCodesRequest activity
• Unusual sequences of mailbox, account, or authentication-related requests

These events matter because the reported campaign used the victim’s authenticated session to access information and create or obtain authentication-related material.

Inspect Browser and Network Telemetry

Review browser local storage for artifacts matching the advisory’s zd_comp_YYYY-MM-DD pattern. Correlate those artifacts with Zimbra access times, user identity, message delivery, and endpoint security alerts.

Review DNS and network telemetry for:

• Frequent queries containing random-looking subdomains
• Outbound connections to unfamiliar or recently registered VPS infrastructure
• Unusual HTTPS connections associated with Zimbra access
• Unexpected outbound data transfers following suspicious activity

Correlate network events with mailbox access, SOAP requests, application passcode creation, and other identity events. A connection alone is not proof of compromise, but it can identify accounts for deeper review.

Preserve and Compare Email Evidence

Search for copies of suspicious messages across user mailboxes, quarantine stores, and mail gateways. Compare message bodies, senders, subjects, delivery times, and headers. Preserve samples before deletion or modification so investigators can determine whether the same campaign reached multiple users.

Indicators of Compromise (IoCs)

Below are the extracted IoCs from the joint advisory. Note that actor infrastructure rotates frequently; validate all indicators against current threat feeds before blocking.

Flowerbed Infrastructure

The advisory attributes this infrastructure to Flowerbed servers used in the Zimbra-targeting campaign.

X.509 Certificate SHA-1 Hashes

These are listed as Let’s Encrypt certificate SHA-1 values tied to Flowerbed infrastructure.

Email Addresses Used to Procure Resources

• ivanka.zurabishvili@proton[.]me
• zmul1@buildandconsulting[.]com
• garrysmithme@pinmx[.]net
• hostingclient@pinmx[.]net

Phishing Distribution Indicators

• c.laurent.ejfa@proton[.]me
• j.moreau.epsc@proton[.]me
• liberty.insights@proton[.]me
• Addresses ending in @isofts.kiev[.]ua
• Addresses ending in @navs.edu[.]ua

The advisory says more recent payload distribution likely shifted toward previously compromised victim accounts.

Malicious Email Sample SHA-256 Hashes

• 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf
• 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874
• b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d
• 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760

These hashes are listed for email samples containing the malicious payload.

Exfiltration Patterns

DNS exfiltration pattern:

https://d-{IDENTIFIER}.{DATA_TYPE}.{BASE32_ENCODED_DATA}.i.{DOMAIN}/pixel.gif

DNS exfiltration uses a d- prefix before the victim identifier, with the next subdomain indicating the data type. The advisory maps data type identifiers such as e for victim email address, c for client type, v for Zimbra version, url for URL at exploitation time, 2fa for scratch codes, pa for newly created application password, and pw for harvested autocomplete password.

HTTPS exfiltration pattern:

https://js-{IDENTIFIER}.i.{DOMAIN}/{URL_PATH}

The advisory says HTTPS exfiltration sends victim email addresses, environment details, newly created application passwords, harvested autocomplete passwords, email content, contacts, attachments, and error logs.

Exfiltration File/Header Indicators

Look for X-Filename header values including:

• zimbra_batch_analytics.json
• telemetry_{1-20}.json
• telemetryData_{0-89}.json

The advisory associates these with SOAP request collection, Global Address List collection, and the last 90 days of victim emails.

Additional Network / Artifact Indicators

• DNS queries to suspicious domains with seemingly random subdomains
• Significant outbound data to VPS provider IPs not normally used by the organization
• Sudden spikes in connections to recently established domains
• Connections to internal webmail from VPN providers frequently used by the actor, including Mullvad VPN
• HTTP response for pixel.gif containing a 1×1 GIF with SHA-256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Zimbra Post-Compromise Artifacts

Check /opt/zimbra/log/mailbox.log for unusual SOAP activity, especially:

• Many SearchGalRequest commands from one user in a short period
• CreateAppSpecificPasswordRequest, especially where the application passcode is named ZimbraWeb
• GetScratchCodesRequest

Also check endpoint browser storage for ZCS webmail localStorage items named:

• zd_comp_YYYY-MM-DD

The advisory says ZimbraWeb application passcodes are almost certainly malicious in this campaign context, and zd_comp_YYYY-MM-DD values can help identify affected users and estimate the scope of email exfiltration.